Web3 · Penetration Testing
Edel.Finance
softstack completed a penetration test of Edel.Finance's codebase in October 2026, reporting 27 findings (2 high, 5 medium, 17 low and 3 informational), of which 25 were resolved or mitigated before the final report. The full report is published in the softstack public audit archive.
Key facts
- Client
- Edel.Finance
- Completed
- Type
- Penetration Testing
- Chains
- Canton, Base
- Market cap
- $18M as of 2026-10-27
About the project
Edel.Finance builds infrastructure for tokenised equities, with issuance and settlement on the Canton Network. Edel Equities issues tokens that give on-chain economic exposure to listed stocks and ETFs. Further products cover issuer financing and, in development, perpetual futures and structured vaults. EDEL is the public ecosystem token and also circulates on Base, Ethereum, BNB Chain and Solana.
Findings
25 of 27 findings resolved before the final report.
| ID | Title | Severity | Status |
|---|---|---|---|
7.1 | Backend dependencies pinned to versions with known CVEs See the published report for the full description. | High | fixed |
7.2 | Cross-user prompt injection through counterpartyOrderId in MCP trade history See the published report for the full description. | High | fixed |
7.3 | Origin reachable outside Cloudflare, with rate limiting keyed on a client-controlled header See the published report for the full description. | Medium | fixed |
7.4 | Managed challenge blocks programmatic API clients but not browser navigation See the published report for the full description. | Medium | fixed |
7.6 | clientOrderId is stored and reflected verbatim as orderId See the published report for the full description. | Medium | fixed |
7.7 | User enumeration on POST /v1/ auth/login/init See the published report for the full description. | Medium | fixed |
7.8 | TLS 1.0 and 1.1 still enabled at the Cloudflare edge See the published report for the full description. | Low | fixed |
7.9 | Missing security headers on the admin (Next.js) responses See the published report for the full description. | Low | fixed |
7.11 | GitHub Actions are not pinned to commit SHAs See the published report for the full description. | Low | fixed |
7.12 | Withdrawal confirmation validates the identifier after running upstream gates See the published report for the full description. | Low | fixed |
7.13 | IMDS hop limit allows containers to reach instance metadata See the published report for the full description. | Low | fixed |
7.14 | Missing HSTS header on API responses See the published report for the full description. | Low | fixed |
7.15 | Origin provider and internal trace identifiers disclosed in response headers See the published report for the full description. | Low | fixed |
7.16 | Missing security headers on API application responses See the published report for the full description. | Low | fixed |
7.17 | Cloudflare managed challenge is applied inconsistently across the admin host See the published report for the full description. | Low | acknowledged |
7.18 | Cloudflare bot gate on the API host is satisfied by a browser- like User-Agent See the published report for the full description. | Low | acknowledged |
7.19 | autoClose take-profit and stop- loss are not validated against side and entry See the published report for the full description. | Low | fixed |
7.20 | API documentation and OpenAPI specification exposed on the origin See the published report for the full description. | Low | fixed |
7.21 | Large public payload served without throttling See the published report for the full description. | Low | fixed |
7.22 | MCP hardening gaps in response handling and rate limiting See the published report for the full description. | Low | fixed |
7.23 | Infrastructure hardening gaps in the Terraform configuration See the published report for the full description. | Low | fixed |
7.24 | 400 "unknown account id" returned for a valid, owned account See the published report for the full description. | Low | fixed |
7.25 | OpenAPI specification does not match live responses See the published report for the full description. | Informational | fixed |
7.26 | Lenient validation on the public candles.limit parameter See the published report for the full description. | Informational | fixed |
7.27 | KYC skip and affiliate self- referral need verification where KYC is enforced See the published report for the full description. | Informational | fixed |
7.5 | Demo origin exposes an unauthenticated /api/dev proxy with wildcard CORS See the published report for the full description. | Medium | fixed |
7.10 | Containers run as root See the published report for the full description. | Low | fixed |
Methodology
Review process
Scoping and threat modelling
The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.
Automated analysis
Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.
Manual code review
Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.
Adversarial testing
Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.
Reporting
Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.
Remediation verification
Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.
Standards and references
- OWASP Top 10The ten most critical web application risks
FAQ
The review reported 27 findings: 2 high, 5 medium, 17 low and 3 informational. 25 of 27 were resolved or mitigated before the final report.
This report covers the code as reviewed in October 2026. Any code changed after that point is outside the reviewed scope.
Disclaimer
This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.